Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-40553

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Low (L)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 12 hours ago Activity log

Created suggestion 1 day, 12 hours ago

Stack-based buffer overflow in gawk

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.

References

https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7… patch
https://cert.pl/en/posts/2026/07/CVE-2026-40467 third-party-advisory

Affected products

gawk

=<5.4.0

Matching in nixpkgs

pkgs.gawk

GNU implementation of the Awk programming language

nixos-unstable 5.4.0
- nixpkgs-unstable 5.4.0
- nixos-unstable-small 5.4.0
nixos-26.05 5.4.0
- nixos-26.05-small 5.4.0
- nixpkgs-26.05-darwin 5.4.0

pkgs.gawkextlib.gd

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.csv

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.mbs

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.xml

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkInteractive

GNU implementation of the Awk programming language

nixos-unstable 5.4.0
- nixpkgs-unstable 5.4.0
- nixos-unstable-small 5.4.0
nixos-26.05 5.4.0
- nixos-26.05-small 5.4.0
- nixpkgs-26.05-darwin 5.4.0

pkgs.gawkextlib.haru

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.json

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.lmdb

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.mpfr

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.abort

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.errno

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.pgsql

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.redis

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.timex

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.aregex

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.select

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawk-with-extensions

None

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.gawkextlib.gawkextlib

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.nl_langinfo

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.minimal-bootstrap.gawk

GNU implementation of the Awk programming language

nixos-unstable 5.3.2
- nixpkgs-unstable 5.3.2
- nixos-unstable-small 5.3.2
nixos-26.05 5.3.2
- nixos-26.05-small 5.3.2
- nixpkgs-26.05-darwin 5.3.2

pkgs.minimal-bootstrap.gawk-mes

GNU implementation of the Awk programming language

nixos-unstable 3.0.6
- nixpkgs-unstable 3.0.6
- nixos-unstable-small 3.0.6
nixos-26.05 3.0.6
- nixos-26.05-small 3.0.6
- nixpkgs-26.05-darwin 3.0.6

pkgs.minimal-bootstrap.gawk-static

GNU implementation of the Awk programming language

nixos-unstable 5.3.2
- nixpkgs-unstable 5.3.2
- nixos-unstable-small 5.3.2
nixos-26.05 5.3.2
- nixos-26.05-small 5.3.2
- nixpkgs-26.05-darwin 5.3.2

Package maintainers

@dasJ Janne Heß <janne@hess.ooo>
@helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de>
@tomberek Thomas Bereknyei <tomberek@gmail.com>
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
@emilytrau Emily Trau <emily+nix@downunderctf.com>
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
@06kellyjac Jack <hello+nixpkgs@j-k.io>
@pyrox0 Pyrox <pyrox@pyrox.dev>
@Artturin Artturi N <artturin@artturin.com>
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>